In brief
A team of researchers using AI tools uncovered a series of critical vulnerabilities in the PHP programming language that have gone unnoticed for over a decade. The flaws allow attackers to hijack web servers without authentication, threatening billions of users worldwide. In response, PHP developers released emergency patches, while US, UK, EU, Singapore and Australian agencies urged immediate updates or site shutdowns. Major sites like Wikipedia, BBC, and the University of Geneva went offline as a precaution. Experts warn that attackers may use AI-enabled exploits to target vulnerable sites, urging owners to apply patches, audit for backdoors, and monitor for phishing attempts.
What is PHP? PHP, short for Hypertext Preprocessor, is a server‑side scripting language that powers millions of websites—from e‑commerce sites and forums to the Wikipedia and WordPress ecosystem. Though the code is invisible to web users, it is the engine that fetches data, builds pages and interacts with databases.
For more than ten years, serious deficiencies in this language’s codebase had sat undetected. The discovery was made on Wednesday by security firms Calf and Wiz, who employed advanced AI models to automatically scan PHP’s source code. The result? A set of zero‑day exploits that let attackers take complete control of any PHP‑based server without needing credentials.
Once the flaw was announced, governments, cyber‑security agencies and tech organisations worldwide sprang into action. The PHP core team issued emergency patches within hours; the United States National Security Agency urged federal departments to shut down un‑patched services. In the UK the National Cyber Security Centre warned of potential backdoor installations, and Canada, Australia and Singapore issued similar advisories. Japanese Prime Minister Sanae Takaichi requested the public check whether their websites rely on PHP and to apply fixes immediately.
The impact has already been felt: major portals such as Wikipedia, the BBC, the Finnish government, the Edinburgh council and the University of Geneva have all taken their public sites offline. Gaming platforms and a large number of small to mid‑size businesses have also gone dark while they apply the new patches.
The role of AI in the discovery illustrates a double‑edged sword. While the technology allowed the researchers to find the flaw rapidly, OpenAI has warned that the same tools could enable cyber‑criminals to create and deploy exploits faster than ever. The updated PHP is a routine patch, but only by applying it—ideally before the software is re‑deployed—can operators close the immediate threat.
Troubleshooting Checklist for Site Owners:
- Run the official PHP compatibility checker released by OpenAI to confirm your platform’s status.
- Download and install the latest PHP 8 release (or the latest 7 version) immediately.
- Scan all server files for unexpected backdoors, especially within user‑supplied directories.
- Check logs for unusual authentication attempts or data exfiltration.
- Shut down the site temporarily if patching cannot be completed within 24 hours.
- Alert users to potential phishing messages that leverage headlines about the vulnerability.
For everyday users, the primary safeguard is vigilance. If a site that you trust prompts you to change your passwords or offers free software “updates,” verify the request through a direct channel—never click links from unsolicited messages. Cyber‑security experts predict a surge in exploit attempts as the technical details become public, so the sooner you patch, the less likely you are a target.
PulseWire brings live updates on the unfolding PHP crisis. Follow our real‑time map of affected sites and join the community discussion on our social media channels.
